hapipal / confidence

Dynamic, declarative configurations
Other
263 stars 43 forks source link

Invalid key names and validation #68

Closed keyCat closed 5 years ago

keyCat commented 7 years ago

Hi,

Quoting documentation:

Key names can only contain alphanumeric characters and '_' with the '$' prefix reserved for special directives. Values can contain any non-object value (e.g. strings, numbers, booleans) as well as arrays.

I think this restriction is counterintuitive and severely limits the scope of usage for Confidence while not bringing any clear benefits. In my opinion, there should not be any restrictions on key names, unless it is due to some technical or conceptual limitation.

My example: I want to create a criteria-based configuration for node modules and plugins using their canonical names, but Confidence does not support dashes. And what is actually more concerning, when it checks for key name`s validity, it strips invalid characters and still tries to reach a key using this sanitized (modified) key name, which may result in collisions and unexpected behavior false. So this is actually becomes a 2-part issue:

  1. Key names should only be limited by use of '$' prefix and '/' characters, everything else that is valid for JavaScript keys should be valid for Confidence.

2. Joi validation must be used to check key identifiers and exceptions must be thrown. not relevant to the issue

I could help with implementation, but looking at the repo I am not sure if the project is still being maintained.

Any discussion on the topic and counterpoints are welcome.

Thanks for this great module.

UPD: Redacted false statement.

patrickkettner commented 7 years ago

i'd be happy to review any PR that changes that functionality

keyCat commented 7 years ago

@patrickkettner I've taken a closer look at the code and found my statement about Confidence trying to reach nodes using invalid key names to be false. As for Joi validation, I come to think that it is not relevant to the issue at all.

Please, take a look at PR, when you will have the time. Thanks a lot.